Hey,
Well... I finally got Ice Cold Beer hacked for free play. This one was particularly important because it only allows 9 credits, and it gets a LOT of play. We took one to CGE and I don't think it ever stopped getting play, except when it ran out of credits, and the person didn't know how to coin it up. The one at my house gets a lot of play when people are over as well.
I kinda expected this to be easy, with the exception of having no emulator to use to assist in hacking, and having to burn an EPROM to test any changes. But it turns out that the whole system is an ugly mess, and the code doesn't make it much better
. I'll admit I don't do much 6809 assembly, but I really don't think the problems stemmed from the language.
But anyway, after looking at just the disassembly and not finding anything particularly useful, I ended up hooking my USB logic analyzer to the 6116 RAM, watching for reads/writes, and since the bus is shared w/ the ROMs, I was able to look a little before it and see what the lower 11 bits of the address are, as well as the data, so I could tell where the code was executing from. Then I determined which address was the credits (and which weren't, including the seperate memory address for the credits display... wtf >_<). So anyway, after logging a bunch of stuff, I went back and modified the code to not decrement the credits when starting the game, as well as always making it think that there's credits while trying to start (and fixed the checksum).
So, the end result is that the display will tell you the actual number of credits, but the start button flashes and starts a game when you press it, even with 0 credits. Nothing else should be affected. You need to burn this to a 27c64, and replace U23. There's no way to turn this on or off... if you want to be able to enable/disable free play, you should burn both the original and the hacked file to a 27c128 and use a switch to toggle between the hacked and unhacked ROM.
Thanks to Scucci for posting the files in the first place, so I could look at the disassembly before actually opening my machine. And attached is a pic of why emulators are great for this stuff
. Heh, at least I didn't have to lug one of my HP 16500s down there though. 
DogP
Well... I finally got Ice Cold Beer hacked for free play. This one was particularly important because it only allows 9 credits, and it gets a LOT of play. We took one to CGE and I don't think it ever stopped getting play, except when it ran out of credits, and the person didn't know how to coin it up. The one at my house gets a lot of play when people are over as well.
I kinda expected this to be easy, with the exception of having no emulator to use to assist in hacking, and having to burn an EPROM to test any changes. But it turns out that the whole system is an ugly mess, and the code doesn't make it much better
But anyway, after looking at just the disassembly and not finding anything particularly useful, I ended up hooking my USB logic analyzer to the 6116 RAM, watching for reads/writes, and since the bus is shared w/ the ROMs, I was able to look a little before it and see what the lower 11 bits of the address are, as well as the data, so I could tell where the code was executing from. Then I determined which address was the credits (and which weren't, including the seperate memory address for the credits display... wtf >_<). So anyway, after logging a bunch of stuff, I went back and modified the code to not decrement the credits when starting the game, as well as always making it think that there's credits while trying to start (and fixed the checksum).
So, the end result is that the display will tell you the actual number of credits, but the start button flashes and starts a game when you press it, even with 0 credits. Nothing else should be affected. You need to burn this to a 27c64, and replace U23. There's no way to turn this on or off... if you want to be able to enable/disable free play, you should burn both the original and the hacked file to a 27c128 and use a switch to toggle between the hacked and unhacked ROM.
Thanks to Scucci for posting the files in the first place, so I could look at the disassembly before actually opening my machine. And attached is a pic of why emulators are great for this stuff
DogP

